How to fix CVE-2024-45337 – Step-by-Step Guide
CVE-2024-45337 addresses a critical vulnerability in Go's crypto/ssh library. This flaw, rated CVSS 9.1, can lead to unauthorized SSH authentication bypass. It impacts Go applications using specific versions of the standard library.
What is Go crypto/ssh – Misuse of ServerConfig.PublicKeyCallback?
This vulnerability stems from a logic flaw in crypto/ssh's ServerConfig.PublicKeyCallback. Applications may incorrectly authorize connections even when public key authentication fails. An attacker can bypass authentication if the callback approves a key, exploiting this flaw in the authentication flow.
Impact and Risks for your Infrastructure
The critical impact is unauthorized SSH authentication bypass in Go applications. Attackers can gain access to SSH servers using any public key, potentially leading to full system compromise, data exfiltration, or service disruption.
Step-by-Step Mitigation Guide
To mitigate CVE-2024-45337, update your Go applications to Go 1.22.10+ or 1.23.4+. Verify the fix by ensuring your Go environment uses the patched versions. Recompile and redeploy affected applications to incorporate the security update.
- 1Upgrade Go to 1.22.10+ or 1.23.4+.
- 2Review your PublicKeyCallback implementation to ensure it rejects unauthorized keys.
- 3Add explicit key allowlist validation inside PublicKeyCallback.
- 4Rotate SSH host keys and audit SSH access logs for anomalies.
- 5Run static analysis (govulncheck) to detect usage of vulnerable patterns.
- 6Pin allowed public keys in your callback rather than relying on post-callback checks.